In October 2026, multiple organizations in Japan suffered unauthorized access incidents leading to personal information leakage. Attackers used artificial intelligence to scan for known vulnerabilities and exploit APIs, including server-side request forgery. They analyzed Android application packages and employed tools to reverse engineer Flutter apps and target various services such as web applications, MySQL databases, Jenkins servers, and email gateways. The attackers attempted to evade endpoint detection and response systems and deployed web shells to gain internal network access. The campaign also affected web services beyond Japan, indicating a wider scope of malicious activity.
Bulletin ID: 2026-054-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:00 PM PDT Description: AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. We identified CVE-2026-15643, a server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Impacted versions: < 0.0.14 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
SAP released security updates in October 2026 addressing 20 vulnerabilities, including a maximum-severity OAuth2 SSRF vulnerability in the Cloud SDK for Python. The flaw involves server-side request forgery related to OAuth2 implementations. No specific affected versions or detailed technical information are provided. No known exploits in the wild have been reported. SAP is not a cloud service in this context, so remediation depends on applying vendor updates.
The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.
SonicWall SMA1000 series appliances have a maximum-severity server-side request forgery (SSRF) vulnerability (CVE-2026-102255) in the Appliance WorkPlace interface affecting models 6210, 7210, and 8200v. This flaw allows remote unauthenticated attackers to exploit an unintended alternate access path to make the appliance issue requests on their behalf, potentially reaching internal functionality and performing unauthorized operations. SonicWall has released hotfixes to address this vulnerability and strongly advises users to apply them. There is currently no evidence of active exploitation in the wild. The SMA1000 series is widely used by government agencies, MSSPs, and large enterprises for secure remote access, making it a high-value target for attackers. Previous SMA1000 vulnerabilities have been exploited in zero-day attacks linked to ransomware gangs. SonicWall continues to monitor and respond to these threats.
SuiteCRM versions 8.10.1 and earlier, including 7.15.1, contain an authenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an authenticated user to cause the server to make HTTP requests to arbitrary locations.
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.
Attackers are obfuscating the IP address 169.254.169.254, used by cloud metadata services, by representing it as hostnames. This technique bypasses simple IP-based blocklists designed to prevent Server Side Request Forgery (SSRF) attacks targeting the cloud metadata service. Dynamic DNS services like 1u.ms enable attackers to create such hostnames on the fly, complicating detection and mitigation efforts.
Linuxfabrik monitoring_plugins version 6.0.0 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability that could allow attackers to make the server perform unintended requests.
Nodemailer versions 9.0.0 and earlier contain vulnerabilities that allow attackers to read arbitrary files on the server and perform server-side request forgery (SSRF). These issues could lead to unauthorized file access and unintended network requests initiated by the server. The vulnerabilities affect all Nodemailer versions up to and including 9.0.0.
CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]
OPeNDAP Hyrax contains a Server Side Request Forgery (SSRF) vulnerability that allows attackers to bypass allowed hosts restrictions via unvalidated HTTP redirects. This can cause the application to communicate with unauthorized internal or external systems. Additionally, user authentication headers, including a legacy Echo-Token credential, may be leaked to attacker-controlled endpoints during these redirects. Exploitation could enable unauthenticated attackers to access internal services and disclose credentials of authenticated users. A fix addressing these issues was released in Hyrax version 1.18.0. Until patched, administrators are advised to restrict gateway exposure to trusted networks.
Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful. Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows: CVE-2026-15969 SGLang contains unauthenticated RCE in /load_lora_adapter_from_tensors by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. CVE-2026-15971 SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. CVE-2026-15974 SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions because image_url input is unsanitized, allowing access to internal metadata, secrets, and services. CVE-2026-15976 SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk , where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files. CVE-2026-15977 SGLang contains a credential leakage vulnerability in the /server_info endpoint, which returns API keys and SSL keyfile information when only the --admin-api-key is configured. CVE-2026-15978 SGLang contains a model weight exfiltration vulnerability when no API keys are configured, because SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights. Impact If exploited, these vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are at the highest risk of exploitation. Solution Until a patch is available, affected users should consider the following mitigations: Mitigations Restrict access to the service interfaces and ensure they are not exposed to untrusted networks. Implement network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints. Change SGLANG_USE_PICKLE_IPC to "false" within environ.py . Disable endpoints not in use to remove potential attack vectors. The SGLang maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with msgpack to prevent deserialization issues such as CVE-2026-14890, but the SGLANG_USE_PICKLE_IPC defaults to true within the codebase at the time of writing. Acknowledgements Thanks to the reporter, Apoorv Dayal [apoorvdayal@outlook.com]. This document was written by Christopher Cullen. Vendor Information One or more vendors are listed for this advisory. Please reference the full report for more information. References https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj https://github.com/sgl-project/sglang/security/advisories/GHSA-wf98-gv64-5wrf https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9 https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8 https://github.com/sgl-project/sglang/security/a…
This article explores the security implications of serverless authentication across major cloud platforms. It details how attackers target serverless functions to exploit vulnerabilities arising from insecure code and misconfigurations. The mechanics of serverless authentication are explained for AWS Lambda, Google Cloud Functions, and Azure Functions. The article outlines potential attack vectors for token exfiltration, including SSRF and RCE, and provides simulations demonstrating how tokens can be extracted and misused. Detection strategies are discussed, focusing on identifying serverless identities and anomalous behavior. Prevention measures are suggested, emphasizing the principle of least privilege and robust input validation. The article concludes by stressing the importance of understanding serverless credential mechanics and implementing proactive security measures to protect cloud environments.
